Gokar
Gokar (W32/Gokar-A) is a worm that runs on Microsoft Windows. It is written by Simon Vallor. Payloads Transmission Gokar spreads via the internet by sending itself as an e-mail attachment to addresses in the Outlook address. Infection When executed, the worm creates a email with the following characteristics: '''Subject: '''The subject is one of the following: * If I were God and didn't belive in myself would it be blasphemy * The A-Team VS KnightRider ... who would win ? * Just one kiss, will make it better. just one kiss, and we will be alright. * I can't help this longing, comfort me. * And I miss you most of all, my darling ... * ... When autumn leaves start to fall * It's dark in here, you can feel it all around. The underground. * I will always be with you sometimes black sometimes white ... * .. and there's no need to be scared, you re always on my mind. * You just take a giant step, one step higher. * The air will hold you if you try, trust my wings of desire. Glory, Glorified....... '''Message: '''The text of the message is one of the following: * Happy Birthday * Yeah ok, so it's not yours it's mine :) * The horizons lean forward, offering us space to place new steps of change. * I like this calm, moments before the storm * Darling, when did you fall..when was it over ? * Will you meet me .... and we'll fly away ?! * You should like this, it could have been made for you * speak to you later * They say love is blind ... well, the attachment probably proves it. * Pretty good either way though, isn't it ? * still cause for a celebration though, check out the details I attached * This made me laugh * Got some more stuff to tell you later but I can't stop right now * so I'll email you later or give you a ring if thats ok ?! * Speak to you later '''Attachment: '''The file name of the attachment consists a random number and some of these strings: tgfdfg jhfxvc cgfd2 trevc t6tr ffdasf glkfh fhjdv qesac kujzv weafs twat rewfd gfdsf hgbv fdsc p0olik 3tgf rf43dr t54refd ut545a r4354gkjw vgrewu xw54re y343rv z3vdf It then goes with a file extension chosen from one of the following: * .pif * .scr * .exe * .com * .bat The worm then adds the mail user's name to the end of the message, and sends the mail to all addresses in your Microsoft Outlook address book. Next, it copies itself to the \Windows folder as Karen.exe. It then and adds the value: Karen c:\windows\karen.exe It then adds the following registry key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run This will cause the worm to be run on each time that the user starts Windows. It then looks for the C:\Mirc folder. If it exists, it creates the file Script.ini in that location, so that it will attempt to send itself through mIRC when mIRC is run. It also searches looks for the C:\inetpub\wwwroot folder, and, if found, it copies itself there as Web.exe. (This folder is found in Microsoft IIS web servers.) It then renames the Default.htm file to Redesi.htm, and it creates a new Default.htm file, which will display the text: We Are Forever Anyone who views this page will be asked to download the Web.exe file. * Category:Worm Category:Win32 Category:Win32 worm Category:Microsoft Windows